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AMENDMENTS TO THE CLAIMS: 

This listing of claims will replace all prior versions and listings of claims in the 
application: 

1 . (Currently Amended) An encryption apparatus for converting a plaintext block into a 
ciphertext block depending on supplied key information, comprising: 

means for randomly selecting one pattern of each of pairs ai, ai (where i is a 
positive integer not less than one) of one or a plurality of predetermined mask patterns 
and mask patterns obtained by bit inversion of the predetermined mask patterns every 
time encryption is performed; 

means for masking bits [[dependent on a]] of the plaintext block within said 
encryption apparatus with the mask patterns selected by said selection means; and 

means for removing an influence of the selected mask [[a]] patterns from [[a]] the 
ciphertext block before the ciphertext block is output from said encryption apparatus . 

2. (Currently Amended) An encryption apparatus for converting a plaintext block into a 
ciphertext block depending on supplied key information, comprising: 

means for randomly selecting one pattern of each of pairs ai, ai (where i is a 
positive integer not less than one) of one or a plurality of predetermined mask patterns 
and mask patterns obtained by bit inversion of the predetermined mask patterns every 
time encryption is performed; 

means for masking intermediate bit data within said encryption apparatus with 
the mask patterns selected by said selection means; and 
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means for removing an influence of the selected mask [[a]] patterns from the 
intermediate bit data masked by said masking means before the ciphertext block is 
output from said encryption apparatus . 

3. (Currently Amended) An encryption apparatus for converting a plaintext block into a 
ciphertext block depending on supplied key information, comprising: 

data translation means for performing data translation to intermediate data within 
said apparatus; 

means for randomly selecting one pattern of each of pairs ai, ai (where i is a 
positive integer not less than one) of one or a plurality of predetermined mask patterns 
and mask patterns obtained by bit inversion of the predetermined mask patterns every 
time encryption is performed; 

means for masking an input to said data translation means with the mask 
patterns selected by said selection means; 

means for removing an influence of the selected mask [[a]] patterns from an 
output from said data translation means,, which is masked by said masking means^ 
before the ciphertext block is output from said encryption apparatus . 

4. (Currently Amended) An apparatus according to claim 1 , wherein said means for 
masking the bits dependent on the plaintext within said encryption apparatus with the 
selected mask patterns and said means for removing the influence of the selected mask 
[fall patterns from the ciphertext block comprise one of;_ [[an]] exclusive OR, addition or 
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subtraction with respect to a modulus, and multiplication or division with respect to the 
modulus. 

5. (Currently Amended) An apparatus according to claim 2, wherein said means for 
masking [[the]]] intermediate bit data within said encryption apparatus with the selected 
mask patterns and said means for removing the influence of the selected mask [[a]] 
patterns from the masked intermediate bit data comprise one of:_ [[an]] exclusive OR, 
addition or subtraction with respect to a modulus, and multiplication or division with 
respect to the modulus. 

6. (Currently Amended) An apparatus according to claim 3, wherein said data 
translation means, said means for masking the input to said data translation means with 
the selected mask patterns, and said means for removing the influence of the selected 
mask [[a]] patterns from the masked output from said data translation means comprise 
one of^ [[an]] exclusive OR, addition or subtraction with respect to a modulus, and 
multiplication or division with respect to the modulus. 

7. (Original) An apparatus according to claim 3, further comprising: 

first storage means for storing, in the form of a table, said means for randomly 

selecting one pattern of each of the pairs ai, ai (where i is a positive integer not less 
than one) of one or the plurality of predetermined mask patterns and the mask patterns 
obtained by bit inversion of the predetermined mask patterns every time encryption is 
performed, said means for masking the input to said data translation means with the 
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mask patterns ai, and said means for removing the influence of the masks ai from the 
masked output from said data translation means; 

second storage means for storing, in the form of a table, said means for masking 
the input to said data translation means with mask patterns a , and said means for 

removing an influence of the masks a from the masked output from said data 
translation means; and 

masked data translation means for randomly selecting one of said first and 
second storage means every time encryption is performed, and performing the 
processing by said data translation means for masked data. 

8. (Currently Amended) An apparatus according to claim 1 , wherein the pair [[a, a 11 ai, 
ai_ of the mask patterns and the mask patterns obtained by bit inversion comprises a 

pair a, a of predetermined fixed mask patterns and mask patterns obtained by bit 
inversion of the fixed mask patterns. 

9. (Currently Amended) An apparatus according to claim 1 , wherein the pair [[a, aW ai, 
ai_ of the mask patterns and the mask patterns obtained by bit inversion are not 
necessarily concealed. 



-5- 



Application No. 09/377,064 
Attorney Docket No. 04329.2148 

10. (Currently Amended) An apparatus according to claim 1 , wherein a Hamming 
weight indicating the number of bits "1s" of an n-bit long bit sequence x is defined as 
H(x), and the Hamming weight H(a) of each of the selected mask [[a]] patterns satisfies 
0 < H(a) < n. 

1 1 . (Currently Amended) An apparatus according to claim 1 , wherein a Hamming 
weight indicating the number of bits "1s" of an n-bit long bit sequence x is defined as 
H(x), and an absolute value of a difference between the Hamming weight H(a) of each 
of the selected mask [[a]] patterns and a Hamming weight H (a) of bit inversion a of 
each of the selected mask [[a]] patterns is less than n/2. 

12. (Currently Amended) A decryption apparatus for converting a ciphertext block into 
a plaintext block depending on supplied key information, comprising: 

means for randomly selecting one pattern of each of pairs ai, ai (where i is a 
positive integer not less than one) of one or a plurality of predetermined mask patterns 
and mask patterns obtained by bit inversion of the predetermined mask patterns every 
time decryption is performed; 

means for masking bits [[dependent on a]] of the ciphertext block within said 
decryption apparatus with the mask patterns selected by said selection means; and 

means for removing an influence of the selected mask [[a]] patterns from [[a]] the 
plaintext block before the plaintext block is output from said decryption apparatus . 
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1 3. (Currently Amended) A decryption apparatus for converting a ciphertext block into 
a plaintext block depending on supplied key information, comprising: 

means for randomly selecting one pattern of each of pairs ai, ai (where i is a 
positive integer not less than one) of one or a plurality of predetermined mask patterns 
and mask patterns obtained by bit inversion of the predetermined mask patterns every 
time decryption is performed; 

means for masking intermediate bit data within said decryption apparatus with 
the mask patterns selected by said selection means; and 

means for removing an influence of the selected mask [[a]] patterns from the 
intermediate bit data masked by said masking means before the plaintext block is 
output from said decryption apparatus . 

14. (Currently Amended) A decryption apparatus for converting a ciphertext block into 
a plaintext block depending on supplied key information, comprising: 

data translation means for performing data translation to intermediate data within 
said apparatus; 

means for randomly selecting one pattern of each of pairs ai, ai (where i is a 
positive integer not less than one) of one or a plurality of predetermined mask patterns 
and mask patterns obtained by bit inversion of the predetermined mask patterns every 
time decryption is performed; 

means for masking an input to said data translation means with the mask 
patterns selected by said selection means; and 
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means for removing an influence of the selected mask [[a]] patterns from an 
output from said data translation means A which is masked by said masking means,, 
before the plaintext block is output from said decryption apparatus . 

15. (Currently Amended) An apparatus according to claim 12, wherein said means for 
masking [[the]] bits d e p e nd e nt on th e p l a i nt e xt of the ciphertext block within said 
decryption apparatus with the selected mask patterns and said means for removing the 
influence of the selected mask [[a]] patterns from the ciphertext block comprise one of:_ 
[[an]] exclusive OR, addition or subtraction with respect to a modulus, and multiplication 
or division with respect to the modulus. 

16. (Currently Amended) An apparatus according to claim 13, wherein said means for 
masking [[the]] intermediate bit data within said decryption apparatus with the selected 
mask patterns and said means for removing the influence of the selected mask [[a]] 
patterns from the masked intermediate bit data comprise one of:_ [[an]] exclusive OR, 
addition or subtraction with respect to a modulus w, and multiplication or division with 
respect to the modulus w. 
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18. (Original) An apparatus according to claim 14, further comprising: 

first storage means for storing, in the form of a table, said means for randomly 

selecting one pattern of each of the pairs ai, ai (where i is a positive integer not less 
than one) of one or the plurality of predetermined mask patterns and the mask patterns 
obtained by bit inversion of the predetermined mask patterns every time decryption is 
performed, said means for masking the input to said data translation means with the 
mask patterns ai, and means for removing the influence of the masks ai from the 
masked output from said data translation means; 

second storage means for storing, in the form of a table, means for masking the 

input to said data translation means with mask patterns a , and means for removing an 

influence of the masks a from the masked output from said data translation means; and 

masked data translation means for randomly selecting one of said first and 
second storage means every time decryption is performed, and performing the 
processing by said data translation means for masked data. 

19. (Currently Amended) An apparatus according to claim 12, wherein the pair [[a, a]] 
ai, ai_ of the mask patterns and the mask patterns obtained by bit inversion comprises a 

pair a, a of predetermined fixed mask patterns and mask patterns obtained by bit 
inversion of the fixed mask patterns. 

20. (Original) An apparatus according to claim 13, wherein the pair ai, aiof the mask 
patterns and the mask patterns obtained by bit inversion are not necessarily concealed. 
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21. (Currently Amended) An apparatus according to claim 12, wherein a Hamming 
weight indicating the number of bits "1s" of an n-bit long bit sequence x is defined as 
H(x), and the Hamming weight H(a) of each of the selected mask [[a]] patterns satisfies 
0 < H(a) < n. 

22. (Currently Amended) An apparatus according to claim 12, wherein a Hamming 
weight indicating the number of bits "1s" of an n-bit long bit sequence x is defined as 
H(x), and an absolute value of a difference between the Hamming weight H(a) of each 
of the selected mask [[a]] patterns and a Hamming weight H(a) of bit inversion a of 
each of the selected mask [[a]] patterns is less than n/2. 

23. (Currently Amended) An encryption method of converting a plaintext block into a 
ciphertext block depending on supplied key information, using an encryption apparatus, 
the method comprising the steps of: 

randomly selecting one pattern of each of pairs ai, ai (where i is a positive 
integer not less than one) of one or a plurality of predetermined mask patterns and 
mask patterns obtained by bit inversion of the predetermined mask patterns every time 
encryption is performed; 

masking bits [[dependent on a]] of the plaintext block within the [[method]] 
encryption apparatus with the selected mask patterns; and 

removing an influence of the selected mask [[a]] patterns from [[a]] the ciphertext 
block before the ciphertext block is output from said encryption apparatus . 
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24. (Currently Amended) An encryption method of converting a plaintext block into a 
ciphertext block depending on supplied key information, using an encryption apparatus, 
the method comprising the steps of: 

randomly selecting one pattern of each of pairs ai, ai (where i is a positive 
integer not less than one) of one or a plurality of predetermined mask patterns and 
mask patterns obtained by bit inversion of the predetermined mask patterns every time 
encryption is performed; 

masking intermediate bit data within the [[method]] encryption apparatus with the 
selected mask patterns; and 

removing an influence of the selected mask [[a]] patterns from the masked 
intermediate bit data before the ciphertext block is output from said encryption 
apparatus . 

25. (Currently Amended) An encryption method of converting a plaintext block into a 
ciphertext block depending on supplied key information, using an encryption apparatus, 
the method comprising the steps of: 

performing data translation to intermediate data within the method; 

randomly selecting one pattern of each of pairs ai, ai (where i is a positive 
integer not less than one) of one or a plurality of predetermined mask patterns and 
mask patterns obtained by bit inversion of the predetermined mask patterns every time 
encryption is performed; 

masking an input to the data translation step with the selected mask patterns; 

and 
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removing an influence of the selected mask [fall patterns from a masked output 
from the data translation step before the ciphertext block is output from said encryption 
apparatus . 

26. (Currently Amended) A method according to claim 23, wherein the step of masking 
the bits dependent on the plaintext within the method with the selected mask patterns 
and the step of removing the influence of the selected mask [[a]] patterns from the 
ciphertext comprise one of_ [[an]] exclusive OR, addition or subtraction with respect to a 
modulus, and multiplication or division with respect to the modulus. 

27. (Currently Amended) A method according to claim 24, wherein the step of masking 
[[the]] intermediate bit data within the m e thod encryption apparatus with the selected 
mask patterns and the step of removing the influence of the selected mask [[a]] patterns 
from the masked intermediate bit data comprise one of:_ [[an]] exclusive OR, addition or 
subtraction with respect to a modulus, and multiplication or division with respect to the 
modulus. 

28. (Currently Amended) A method according to claim 25, wherein the data translation 
step, the step of masking the input to the data translation step with the selected mask 
patterns, and the step of removing the influence of the selected mask [[a]] patterns from 
the masked output from the data translation step comprise one of_ [[an]] exclusive OR, 
addition or subtraction with respect to a modulus, and multiplication or division with 
respect to the modulus. 
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29. (Currently Amended) A method according to claim 25, further comprising the steps 
of: 

storing, in the form of a table, the step of randomly selecting one pattern of each 
of the pairs ai, ai (where i is a positive integer not less than one) of one or the plurality 
of predetermined mask patterns and the mask patterns obtained by bit inversion of the 
predetermined mask patterns every time encryption is performed, the step of masking 
the input to said data translation step with the selected mask patterns [[ai]] and the step 
of removing the influence of the selected mask[[s ai]] patterns from the masked output 
from the data translation step; 

storing, in the form of a table, the step of masking the input to said data 

translation step with the selected mask patterns [[a ,]] and the step of removing an 

influence of the selected mask[[s a]] patterns from the masked output from the data 
translation step; and 

randomly selecting one of the first and second storage steps every time 
encryption is performed, and performing the processing in the data translation step for 
masked data. 

30. (Original) A method according to claim 23, wherein the pair ai, aiof the mask 

patterns and the mask patterns obtained by bit inversion comprises a pair a, a of 
predetermined fixed mask patterns and mask patterns obtained by bit inversion of the 
fixed mask patterns. 
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31 . (Currently Amended) A method according to claim 23, wherein [[that]] the pair a, a 
of the mask patterns and the mask patterns obtained by bit inversion are not necessarily 
concealed. 

32. (Currently Amended) A method according to claim 23, wherein a Hamming weight 
indicating the number of bits "1" of an n-bit long bit sequence x is defined as H(x), and 
the Hamming weight H(a) of each of the selected mask [[a]] patterns satisfies 0 < H(a) < 
n. 

33. (Currently Amended) A method according to claim 23, wherein a Hamming weight 
indicating the number of bits "1s M of an n-bit long bit sequence x is defined as H(x), and 
an absolute value of a difference between the Hamming weight H(a) of each of the 

selected mask [[a]] patterns and a Hamming weight H (a) of bit inversion a of each of 

the selected mask [[a]] patterns is less than n/2. 

34. (Currently Amended) A decryption method of converting a ciphertext block into a 
plaintext block depending on supplied key information, using a decryption apparatus, 
the method comprising the steps of: 

randomly selecting one pattern of each of pairs ai, ai (where i is a positive 
integer not less than one) of one or a plurality of predetermined mask patterns and 
mask patterns obtained by bit inversion of the predetermined mask patterns every time 
decryption is performed; 



-14- 



Application No. 09/377,064 
Attorney Docket No. 04329.2148 

masking bits [[dependent on a]] of the ciphertext block within the [[method]] 
decryption apparatus with the selected mask patterns; and 

removing an influence of the selected mask [[a]] patterns from [[a]] the plaintext 
block before the plaintext block is output from the decryption apparatus . 

35. (Currently Amended) A decryption method of converting a ciphertext block into a 
plaintext block depending on supplied key information, using a decryption apparatus, 
the method comprising the steps of: 

randomly selecting one pattern of each of pairs ai, ai (where i is a positive 
integer not less than one) of one or a plurality of predetermined mask patterns and 
mask patterns obtained by bit inversion of the predetermined mask patterns every time 
decryption is performed; 

masking intermediate bit data within the [[method]] decryption apparatus with the 
selected mask patterns; and 

removing an influence of the selected mask [[a]] patterns from the masked 
intermediate bit data before the plaintext block is output from said decryption apparatus . 

36. (Currently Amended) A decryption method of converting a ciphertext block into a 
plaintext block depending on supplied key information, using a decryption apparatus, 
the method comprising the steps of: 

performing data translation to intermediate data within the method; 

randomly selecting one pattern of each of pairs ai, ai (where i is a positive 
integer not less than one) of one or a plurality of predetermined mask patterns and 
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mask patterns obtained by bit inversion of the predetermined mask patterns every time 
decryption is performed; 

masking an input to the data translation step with the selected mask patterns; 

and 

removing an influence of the selected mask [[a]] patterns from a masked output 
from the data translation step before the plaintext block is output from the decryption 
apparatus . 

37. (Currently Amended) A method according to claim 34, wherein [[that]] the step of 
masking [[the]] bits [[dependent on]] of the ciphertext block within the [[method]] 
decryption apparatus with the selected mask patterns and the step of removing the 
influence of the selected mask [[a]] patterns from the block plaintext comprise one ofj_ 
[[an]] exclusive OR, addition or subtraction with respect to a modulus w, and 
multiplication or division with respect to the modulus w. 

38. (Currently Amended) A method according to claim 35, wherein the step of masking 
[[the]] intermediate bit data within the [[method]] decryption apparatus with the selected 
mask patterns and the step of removing the influence of the selected mask [[a]] patterns 
from the masked intermediate bit data comprise one:_of [[an]] exclusive OR, addition or 
subtraction with respect to a modulus, and multiplication or division with respect to the 
modulus. 
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39. (Currently Amended) A method according to claim 36, wherein the data translation 
step, the step of masking the input to the data translation step with the selected mask 
patterns, and the step of removing the influence of the selected mask ffall patterns from 
the masked output from the data translation step comprise one of an exclusive OR, 
addition or subtraction with respect to a modulus, and multiplication or division with 
respect to the modulus. 

40. (Currently Amended) A method according to claim 36, further comprising the steps 
of: 

storing, in the form of a table, the step of randomly selecting one pattern of each 

of the pairs ai, ai (where i is a positive integer not less than one) of one or the plurality 
of predetermined mask patterns and the mask patterns obtained by bit inversion of the 
predetermined mask patterns every time decryption is performed, the step of masking 
the input to said data translation step with the selected mask patterns [[ai]], and the step 
of removing the influence of the selected masks [[ai]] patterns from the masked output 
from the data translation step; 

storing, in the form of a table, the step of masking the input to said data 

translation step with the selected mask patterns [[«]], and the step of removing an 

influence of the selected mask pattern masks t t from the masked output from the data 
translation step; and 

randomly selecting one of the first and second storage steps every time 
decryption is performed, and performing the processing in the data translation step for 
masked data. 
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41. (Currently Amended) A method according to claim 34, wherein the pair [[a, a]] ai_ 
jri of the mask patterns and the mask patterns obtained by bit inversion comprises a 

pair a, a of predetermined fixed mask patterns and mask patterns obtained by bit 
inversion of the fixed mask patterns. 

42. (Currently Amended) A method according to claim 34, wherein the pair [[a, all ai, 
ai of the mask patterns and the mask patterns obtained by bit inversion are not 
necessarily concealed. 

43. (Currently Amended) A method according to claim 34, wherein a Hamming weight 
indicating the number of "1" bits of an n-bit long bit sequence x is defined as H(x), and 
the Hamming weight H(a) of each of the selected mask [[a]] patterns satisfies 0 < H(a) < 
n. 

44. (Currently Amended) A method according to claim 34, wherein a Hamming weight 
indicating the number of "1" bits of an n-bit long bit sequence x is defined as H(x), and 
an absolute value of a difference between the Hamming weight H(a) of each of the 

selected mask [[a]] patterns and a Hamming weight H (a) of bit inversion a of the each 

of the selected mask [[a]] patterns is less than n/2. 
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45. (Currently Amended) A computer-usable program storage medium storing 
computer-readable program code means for converting a plaintext block into a 
ciphertext block depending on supplied key information, using an encryption apparatus, 
comprising: 

computer-readable program code means for causing a computer to randomly 

select one pattern of each of pairs ai, ai (where i is a positive integer not less than one) 
of one or a plurality of predetermined mask patterns and mask patterns obtained by bit 
inversion of the predetermined mask patterns every time encryption is performed; 

computer-readable program code means for causing said computer to mask bits 
[[dependent on a]] of the plaintext block within the [[method]] encryption apparatus with 
the selected mask patterns; and 

computer-readable program code means for causing said computer to remove an 
influence of the selected mask [[a]] patterns from [[a]] the ciphertext block before the 
ciphertext block is output from said encryption apparatus . 

46. (Currently Amended) An encryption apparatus for converting a plaintext block into 
a ciphertext block depending on supplied key information, comprising: 

means for randomly selecting one pattern of each of pairs ai, ai (where i is a 
positive integer not less than one) of one or a plurality of predetermined mask patterns 
and mask patterns obtained by bit inversion of the predetermined mask patterns every 
time encryption is performed; 

means for masking bits of the plaintext block dependent on a key within said 
encryption apparatus with the mask patterns selected by said selection means; 
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data translation means for converting intermediate data within said apparatus 
with the key; and 

means for removing an influence of the selected mask [[a]] patterns from an 
output from said data translation means before the ciphertext block is output from said 
encryption apparatus . 

47. (Currently Amended) An apparatus according to claim 46, wherein the pair [[a, a]] 
ai, ai of the mask patterns and the mask patterns obtained by bit inversion comprises a 

pair a, a of predetermined fixed mask patterns and mask patterns obtained by bit 
inversion of the fixed mask patterns. 

48. (Currently Amended) An apparatus according to claim 46, wherein the pair [[a, a]] 
ajj_aiof the mask patterns and the mask patterns obtained by bit inversion are not 
necessarily concealed. 

49. (Currently Amended) An apparatus according to claim 46, wherein a Hamming 
weight indicating the number of bits "1s" of an n-bit long bit sequence x is defined as 
H(x), and the Hamming weight H(a) of each of the selected mask [[a]] patterns satisfies 
0 < H(a) < n. 
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50. (Currently Amended) An apparatus according to claim 46, wherein a Hamming 
weight indicating the number of bits "1s" of an n-bit long bit sequence x is defined as 
H(x), and an absolute value of a difference between the Hamming weight H(a) of each 

of the selected mask [[a]] patterns and a Hamming weight H (a) of bit inversion a of 
each of the selected mask [[a]] patterns is less than n/2. 

Claim 51. (Canceled). 
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